search

google / oss-fuzz

OSS-Fuzz - continuous fuzzing for open source software.
https://google.github.io/oss-fuzz
Apache License 2.0
10.54k stars 2.23k forks source link

tinyxml2 missing corpus #12450

Open DavidKorczynski opened 2 months ago

DavidKorczynski commented 2 months ago

I noticed tinyxml2 have missed corpus for a while, causing some issues in the coverage build: https://oss-fuzz-build-logs.storage.googleapis.com/index.html#tinyxml2

Around a month ago some changes were merged that (1) changed the name of an existing harness; (2) added a new harness: https://github.com/google/oss-fuzz/pull/11985 -- could this be the culprit?

correctmost commented 2 months ago

I think I am seeing a similar issue with librsvg. The last corpus link is from August 12th and the last coverage link is from August 21st.

I read about some infrastructure issues at the time (https://github.com/google/oss-fuzz/issues/12358#issuecomment-2292276519), so I was hoping things would eventually clear up. Do the dates line up with what you're seeing?

librsvg_corpus

oliverchang commented 1 month ago

For tinyxml2, this is likely due to the binary name having an extension (.cpp) that threw off ClusterFuzz. This should be fixed in https://github.com/google/oss-fuzz/commit/0203b407fd840548ddfca25d5e9fe79d7beb641b

jonathanmetzman commented 1 month ago

I think I am seeing a similar issue with librsvg. The last corpus link is from August 12th and the last coverage link is from August 21st.

I read about some infrastructure issues at the time (#12358 (comment)), so I was hoping things would eventually clear up. Do the dates line up with what you're seeing?

librsvg_corpus

Whatever happened here, I think it is fixed, the latest coverage report is from yesterday: https://storage.googleapis.com/oss-fuzz-coverage/librsvg/reports/20240917/linux/report.html

correctmost commented 1 month ago

Whatever happened here, I think it is fixed, the latest coverage report is from yesterday: https://storage.googleapis.com/oss-fuzz-coverage/librsvg/reports/20240917/linux/report.html

Thanks, the "Coverage" links are consistently showing up again on the Fuzzer Statistics page.

Note: sometimes the coverage reports are present on storage.googleapis.com but no corresponding link is present on the Fuzzer Statistics page. For example, librsvg/reports/20240910/linux/report.html is present but there is no link in the Sep 10, 2024 row. Maybe that was fixed with the recent infrastructure changes, though.

The corpus link is still not showing up, but I can file that separately because it does not seem related to the original tinyxml2 issue.